Privacy notice

Last updated: 5 October 2026

Booked by Sandbanks Digital, called Booked in this notice, is booking software made and run by Sandbanks Digital Ltd. Businesses use it to take appointments; their clients book through a booking page or a widget on the business's website. This notice says what Booked does with personal information, whether you are booking an appointment, use Booked at work, or have connected a Google, Microsoft, Zoom or other calendar account to it.

1. Who is responsible

When you book with a business, that business decides what it asks you, what it does with the answers and how long it keeps them. In data protection law it is the controller, and Sandbanks Digital Ltd runs Booked for it as its processor. Questions about your booking, and requests to see, correct or delete your information, go to that business: its name is on the booking page and in every email about your booking. The booking form says this under its button, and links to the business's own privacy notice where the business has given us its address. We help the business answer.

For the accounts of people who use Booked at work, and for keeping the service secure and running (sign-in, security records, server logs), Sandbanks Digital Ltd is the controller.

For what staff do in Booked for their organisation (working hours, connected calendar and video accounts, actions on bookings and the audit log), the organisation is the controller and we are its processor. Ask your organisation about those; we help it answer.

Our legal reasons. Where we are the controller, we use staff account details because we need them to provide Booked to the business that asked for the account (our legitimate interest in providing the service we have agreed to provide), and sign-in records and server logs to keep the service secure and working (our legitimate interest in security). Where a business is the controller, it decides its own legal reason, which is usually that the information is needed to arrange the appointment you asked for.

Sandbanks Digital Ltd is registered in England and Wales, company number 17268570, at 457 Ashley Road, Poole, BH14 0AX, United Kingdom, and with the Information Commissioner's Office under number ZC206995. Contact: [email protected].

2. If you book an appointment

What Booked collects

• Your name and email address, and your phone number if you give it (it is needed only when the business will phone you).
• The appointment you chose, your time zone and your language. The time zone and language come from your browser.
• Your answers to any questions the business has added to its form.

You do not create an account or a password. Booked does not store your IP address or anything about your device with your booking.

What it is used for

To make the booking, show it to the business, send you a confirmation and reminders, let you change or cancel it, and take payment where the business charges. Booked does not use your details for advertising, does not build a profile of you and does not sell them.

Who receives it

• The business's staff. Owners, administrators and people with the view-only role see every booking. Team leads see their team's bookings. Other staff see the bookings they host, unless the business lets everyone see all of them. Anyone who can see a booking can see all its answers. A business can mark a question as sensitive: those answers are left out of emails, and out of calendar entries unless the business chooses to include them.
• Emails to the business. Booked emails the person you are seeing, and any other address the business has chosen for notifications, when you book, move or cancel. Those emails contain your name, email address, phone number, the appointment and your answers, apart from sensitive ones.
• The host's calendar. If the person you are seeing has connected a calendar (Google, Microsoft 365 or Outlook, iCloud, Fastmail or similar), Booked puts an entry in it with your name, email address, phone number, the place or video link and your answers. If the business approves bookings first, a provisional entry is added while your request waits.
• Zoom, for a Zoom appointment: Booked creates the meeting, and its title includes your name.
• Email and text delivery. Emails are sent through Resend. Texts, where the business uses them, are sent through Twilio to the number you gave.
• Stripe, where you pay. You pay on Stripe's own page, to the business's Stripe account. Booked sends Stripe your email address, the amount and what the payment is for. Your card details never reach Booked.
• The business's own systems, if it has asked Booked to notify them: your name, email address, phone number, time zone and language, the appointment and its status, and any reason given when it was cancelled or declined. Never your answers.
• Sandbanks Digital Ltd. Our staff who administer Booked can open a business's bookings, including answers, to support it.

Your booking link

Your emails contain a link for changing or cancelling the booking. It works without signing in, until the appointment has ended. Anyone who has the link can see what the appointment is, its time and place, and your name and email address. Where the business allows it, they can also cancel or move it. So treat the link as private.

How long it is kept

The business sets this. Unless it has chosen otherwise, the details of each appointment are removed 12 months after it ended or was last changed. Where the business has marked an appointment as a client's, its details are kept until the business removes them. Businesses can also remove one person's details at any time.

Removing details deletes your name, email address, phone number, time zone, answers and any reason given from your bookings, along with the records of the emails and texts sent to you. If the business removed your details because you asked, or exported them for you, its audit log keeps your email address as a record that it was done.

A record that an appointment took place stays, without those details: its date, type, host, place and any payment reference. Removal in Booked does not reach copies that already exist elsewhere: the entry in the host's calendar and the Zoom meeting for an appointment that took place, emails and texts already delivered, Stripe's record of a payment, and anything sent to the business's own systems. Ask the business about those.

A business that must check for conflicts of interest (a law firm, for example) can choose to keep a separate record after your details are removed. It holds your name, any other names you gave in answer to the questions the business uses for these checks, the type of appointment and the date you first got in touch. Booked does not announce this on the booking page, so ask the business, or read its privacy notice (linked from the booking form and from the page for changing your booking, where the business has given us its address), to find out whether it keeps one.

Automatic decisions

Booked applies the business's rules without a person looking at each case. They decide whether a booking is confirmed at once or waits for someone to approve it, when an unanswered request lapses, which appointment or member of staff a form sends you to, which of several staff takes an appointment, and whether a paid booking you cancel is refunded. A business can let people who have booked with it before skip approval. Booked also limits how many open requests one email address can have with a business, and how many bookings can be made from one internet address in an hour. It does not score or rank people.

3. If you use Booked at work

• Your account: your email address, name, role in each organisation, and your language and appearance preferences. You cannot sign up yourself: an account is made when an administrator of your organisation or Sandbanks Digital Ltd invites or adds you, or, if your organisation has switched this on, the first time you sign in through its own sign-in. Your email address comes from whoever invites you. You need an email address to have an account; your name is optional. If you sign in with Google, Microsoft or your organisation's own sign-in, your email address comes from that service. There is no password.
• Sign-in records: each sign-in stores the time, the method, your IP address and the description your browser sends of itself (its name and version, and your device's operating system), for security. They are deleted 30 days after the session ends.
• What colleagues see: everyone in your organisation can see your name, email address, role and working hours. Owners and administrators can also see which calendar and video accounts you have connected, each account's email address and the names of your calendars, and can change which calendars are used or disconnect an account. Your email address is the reply-to address on emails about your bookings unless your organisation sets another.
• What you do: approving, declining, cancelling or moving a booking while signed in is recorded on that booking with your account. A decision made from the approve or decline link in an email is recorded as made by link, without your account. Changes to settings, data exports and deletions are recorded in your organisation's audit log, which its owner can read.
• Our access: Sandbanks Digital Ltd staff who administer Booked can open any organisation to support it. When one of them is signed in and opens an organisation they do not belong to, that is recorded in the organisation's audit log, about once an hour rather than for every page. Access by our own tools using a platform key, and work done directly on the database, are not recorded there.
• Leaving: write to [email protected], or ask your organisation's owner to. We remove you from the organisation, and your connected accounts there go with it. If you belong to no other organisation, we delete your account and its sign-in details too. Owners cannot remove accounts themselves in Booked.

4. Google user data and other connected accounts

Connecting an account is always your choice, and Booked asks only for what the features below need.

Sign in with Google

Booked asks Google only for your email address (openid, email). It uses your Google account identifier, your email address and whether Google has verified it, and stores the identifier and email address so that it recognises you next time. It keeps no Google access token from signing in, and signing in gives Booked no access to anything else in your Google account.

Google Calendar and Google Meet

When you connect Google Calendar, Booked asks for your email address (to label the connection) and these permissions: calendar.events.owned, calendar.freebusy, calendar.calendarlist.readonly. With them it does four things, and nothing else:

• Lists your calendars (their names and identifiers), including calendars other people have shared with you. It stores that list. To begin with, your main calendar is the one that blocks booking times and receives bookings; you can change both under Connections at any time. A calendar someone has shared with you can block booking times, but only a calendar your Google account owns can receive bookings. Booked asks for the list again once a day to check that the connection still works, and keeps only whether it did.
• Reads when you are busy, in the calendars set to block booking times: only the start and end of each busy period, never an event's title, guests or contents. Busy times are held only in the server's memory, for up to 60 seconds, and are never written to the database or to logs. They are used only to leave times you are not free out of what people can book.
• Adds, updates and removes the entries for bookings made through Booked, in the one calendar selected to receive bookings. Google's permission for this covers events in calendars your Google account owns, not calendars other people have shared with you. Booked does not read events, and does not change or delete any event it did not create.
• Asks Google for a Meet link, for booking types that use Google Meet. Booked stores the link with the booking. It puts the link in the emails and texts about that booking: to the person who booked (and in the calendar invitation attached to their email), to you and any co-hosts, and to any notification addresses your organisation has set. It also puts it in the calendar entries of any co-hosts, whichever calendar provider they use. For a group session, everyone booked on it gets the same link.

Booked stores your Google account's email address, the access and refresh tokens (encrypted), your list of calendars and your choices, and the identifiers of the entries it created. Your organisation's owners and administrators can see which Google account you connected and the names of its calendars, and can change your calendar choices or disconnect it. Other colleagues cannot.

What Booked does not do with Google user data. It does not sell it or use it for advertising. It does not use it, or pass it to anyone else, to develop, improve or train artificial intelligence or machine learning models. It does not transfer it to anyone else, except as needed to provide the features above (the Meet link in emails, texts and co-hosts' calendar entries, sent through our email and text providers and the co-hosts' calendar providers; storage with our hosting provider), to keep Booked secure, to comply with the law, or as part of a merger or sale of our business, and then only if you have clearly agreed to it beforehand. Nobody at Sandbanks Digital Ltd reads it unless you have asked us to for support, it is necessary for security or to investigate a fault or abuse, or the law requires it.

Booked's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting Google user data. Booked keeps your Google email address, the tokens, your list of calendars and your choices for as long as the connection exists. Under Connections in Booked, disconnecting deletes all of these straight away. Entries already in your calendar stay there, and Booked can no longer update or remove them. Each booking keeps the identifier of its calendar entry, the identifier of the calendar it went into (for your main calendar this is usually your Google email address) and its Meet link for as long as the record of the appointment is kept (section 10). The identifier and email address from Sign in with Google are kept until your Booked account is deleted. A deleted connection can remain in a backup of the database for up to 30 days.

Disconnecting also tells Google to end Booked's access to that Google account. There are two exceptions. If the same Google account is connected elsewhere in Booked, for example in another organisation, the permission stays until the last of those connections is disconnected. If Google cannot be reached at that moment, the connection is still deleted, and you can remove Booked yourself on the page of your Google Account that lists the apps with access to it. Ending access at Google ends everything Booked was allowed for that account, including Sign in with Google, so Google will ask you to agree again the next time you sign in with it.

If you remove the permission at Google first, the connection stops working at once, and Booked erases the stored tokens as soon as Google tells it the permission has gone: the next time Booked needs the calendar, or at a daily check. To have anything else deleted, write to [email protected].

Microsoft 365, Outlook and Teams

The same features, with Microsoft's permissions (Calendars.ReadWrite, User.Read, offline_access, openid, email). To find busy times Booked reads, for each event in the calendars set to block booking times, only its start, end, free or busy status and whether it was cancelled. Teams links come with the calendar entries Booked creates. What Booked keeps, how long, and what it will not do with it are the same as for Google above: nothing from a connected Microsoft account is used for advertising or to develop or train artificial intelligence. Disconnecting deletes the stored tokens and your list of calendars; to withdraw the permission at Microsoft as well, remove Booked in your Microsoft account.

iCloud, Fastmail and other calendars

These connect with an app-specific password, which Booked stores encrypted. To find busy times the calendar server sends whole events; Booked uses their times and discards the rest at once.

Zoom

Booked reads your Zoom account's email address and user identifier. It stores the email address to label the connection and, for one-click connections, the identifier so that it can act when you remove Booked at Zoom, along with the connection's tokens or keys (encrypted). It creates, moves and deletes the meetings for your bookings and stores each meeting's identifier and join link. It does not read your other meetings, recordings or contacts. If you remove Booked from your Zoom account, Booked deletes the connection.

5. Cookies and tracking

• One cookie, for staff only. booked_session keeps you signed in to the dashboard for up to 30 days. It is essential, so no consent banner is shown. Booked gives people who book no cookies and keeps nothing in their browser's storage. Cloudflare, which protects the site, sets no cookie in normal use. If it suspects a visitor is a robot and shows a check, it sets a security cookie when the check is passed, which lasts about half an hour.
• No advertising or analytics. Booked's pages load no advertising, analytics or social media scripts, and their fonts come from Booked itself. The emails Booked sends contain no tracking images, and open and click tracking are switched off with our email provider.
• Counting visits. For each booking type Booked keeps a daily count of how many times its page was opened and how many times a time was chosen. The count holds nothing about who visited.
• Checking for robots. Booking forms contain a hidden field that only automated programs fill in. Where Cloudflare's Turnstile check is switched on, the form loads a script from Cloudflare. That script looks at your browser and device to tell people from programs, and may keep what it needs for the check in your browser. Booked then sends Cloudflare your IP address to verify the result.
• Paying. Stripe's payment page is Stripe's own and sets its own cookies.
• The widget on a business's website sets no cookies. It tells that website only that a booking was made, when it is and for which kind of appointment.
• Developers: the API reference page is the one exception to the points above. It loads its viewer from the jsDelivr network. The viewer may load fonts from jsDelivr or Google Fonts and may keep its own settings in your browser.

6. Server logs

Booked's own log records, for every request, the time, the website and page requested, the IP address, the result and how long it took. It leaves out everything after the question mark in an address, masks the private part of emailed links, and does not record what was typed into forms. When something fails, the log also holds the error message; a message that comes back from another company's system can include an email address or a phone number.

Our hosting provider keeps its own log of each request too, which Booked cannot mask: the page requested (again without anything after the question mark), the IP address and the browser's description of itself. Logs are used for security and to find faults, and our hosting provider keeps them for 30 days. Cloudflare, which sits in front of Booked, keeps its own records of requests, including IP addresses, for about a month.

7. The companies that help us run Booked

A business can also have Booked notify its own systems, and can sign its staff in through its own sign-in provider. Those are that business's choices.

8. Where information is kept

Booked and its database run in the European Union (Amsterdam, the Netherlands). The United Kingdom treats the European Economic Area as providing adequate protection.

Some of the companies in section 7 are based in the United States and may handle information there or elsewhere outside the UK and the European Economic Area: Railway, Cloudflare, Resend, Twilio and Stripe. Our agreements with Cloudflare, Resend, Twilio and Stripe cover those transfers in the ways UK law accepts: the UK-US data bridge, where the company is certified under it, and otherwise the standard contractual clauses with the UK addendum or the UK International Data Transfer Agreement. Railway keeps Booked's database in the European Union, and we are putting the same terms in place with it. Write to [email protected] to ask which applies to a company, or for a copy of the terms.

9. Security

• Connections to Booked use HTTPS.
• Answers to a business's questions, and the tokens and passwords for connected calendar and video accounts, are encrypted in the database with AES-256-GCM, with keys held outside the database.
• Session tokens and API keys are stored only as one-way hashes. Sign-in links and booking links are checked against one-way hashes too; a copy of each link is also held, encrypted, with the queued email or text that carries it. Booked accounts have no passwords, so there are none to store.
• Each organisation's information is kept separate, and what staff can see depends on their role.
• Emailed sign-in links work once and for 15 minutes.

No system is perfectly secure. If something goes wrong that affects your information, we will tell the business concerned, and you where the law requires.

10. How long information is kept

11. Your rights

You can ask to see the information held about you, to have it corrected or deleted, to have its use restricted and, in some cases, to receive a copy you can take elsewhere. Where a business relies on your consent, you can withdraw it at any time. Which of these apply depends on where you live and on the legal reason for using the information.

• If you booked with a business, ask that business. Booked gives it the means to export and delete your details, and we will help it if asked. If you cannot reach it, write to [email protected] and we will pass your request on.
• If you use Booked at work, or your request is about Sandbanks Digital Ltd itself, write to [email protected].

Your right to object. Where Sandbanks Digital Ltd is the controller, it relies on its legitimate interests (section 1). You can object to that use at any time, wherever you live, by writing to [email protected]. We will stop unless we have a compelling reason to continue, and we will tell you what it is.

Complaints. If you are unhappy with how your information has been handled, say so: to the business if you booked with one, or to us at [email protected]. We acknowledge complaints within 30 days, look into them and tell you what we found. You can also complain to a regulator at any time: in the United Kingdom, the Information Commissioner's Office (ico.org.uk); in Canada, the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information; elsewhere, the privacy authority where you live.

Booked is meant for businesses and their adult clients. It is not directed at children.

12. Changes and contact

When this notice changes, the date at the top changes with it, and businesses that use Booked are told about anything significant. Questions: [email protected], or Sandbanks Digital Ltd, 457 Ashley Road, Poole, BH14 0AX, United Kingdom. The people responsible for privacy at Sandbanks Digital Ltd are Dan Laws and Elliot Padley, at the same addresses.